MintsLoader from Storm-0426

Summary

In March 2025 Microsoft watched the group it tracks as Storm-0426 send thousands of messages to recipients in Germany. The pretext was a bill from a web hosting company, and the link went not to the lure but to a Prometheus traffic direction system standing on a spread of broken-into sites. Visitors who passed through it landed on mein-lonos-cloude[.]de, a name that plays on a German hosting brand and which Microsoft states the attacker controlled. There the ClickFix routine asked for a human verification step; carrying out the displayed steps ran the operator's code. The goal was MintsLoader, a loader whose purpose is to bring down further malware once it has a foothold. Microsoft records derko-meru[.]online as the loader's controller. Both names were observed on 26 March 2025.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

1 of 2

Checks recorded

2

Checks since publication

2

Never checked

1

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 1 indicator has never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Indicators

2 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.